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Codes exist which are capable of correcting large numbers of random 
errors. Such codes are rarely used in practical data transmission systems, 
however, because the equipment necessary to realize their capabilities — that 
is, to actually correct the errors — is usually prohibitively complex and ex- 
pensive. The problem of finding simply implemented decoding algorithms 
or, equivalently, codes which can be decoded simply with existing methods, 
is perhaps the outstanding unsolved problem in coding theory today. 

In this paper, a new class of random-error-correcting cyclic codes is de- 
fined. These codes have two very desirable features: the binary members of the 
class are nearly as powerful as the best-known codes in the range of interest, 
and they can be decoded with the simplest known decoding algorithm. 
Unfortunately there are relatively few codes with useful parameters in this 
class, despite the fact that the class is infinite. 

I. INTRODUCTION 

The Bose-Chaudhur^-Hocquenghem 2 (BCH) cyclic codes are, as a 
class, the best of the known, constructive, random-error-correcting 
codes. Fortunately a decoding algorithm, which can be implemented 
with a reasonable amount of equipment, has been found for these 
codes. 3,4,6 

In this paper, a new class of random-error-correcting cyclic codes is 
presented. These codes can be implemented much more simply than the 
BCH codes and are approximately as powerful. Unfortunately, the class 
is a small one. 

II. DIFFERENCE-SET CYCLIC CODES 

A simple perfect difference set of order I and modulus n = I (I — 1 ) 
+ 1 is denned as a collection of I integers chosen from the set {0, 1, 
■ ■ • , 1(1 — 1)} such that no two of the 1(1 — 1) ordered differences 
modulo n are identical. That is, each occurs once. Singer 6 has shown 
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how to construct such sets when I = p" + 1, p prime, s a positive inte- 
ger, while Evans and Mann 7 have shown that a perfect difference set 
cannot be constructed for any other value of I ^ 1600. 

Since adding a fixed integer to every element of a perfect difference 
set clearly results in another such set, no loss of generality is suffered by 
considering only sets containing the element 0. In what follows, all 
perfect difference sets will be of this type. 

Denote the elements of a perfect difference set of order p' -f- 1 by 
di = 0, d 2 , ■ • • , dp°+i and let 

e(x) = x dl + x d > + ••• +/ pS+1 

be a polynomial in the algebra of polynomials modulo x n — 1. The coef- 
ficients of all polynomials are taken from GF(p T ), r ^ s. Consider the 
n-by-n cyclic matrix 6 over GF (p r ) whose rows are the coefficient vectors 
of 9(x), xd(x), ■ • • , z n-1 0(:c). For reasons which will become apparent 
shortly, the subspace of w-tuples generated by the rows of this matrix, 
which is an ideal in the algebra of polynomials modulo x" — 1, will be 
considered to be the null space of a cyclic code of length n. The rank 
of this matrix, which will be shown to be the number of check symbols 
in the code, can be determined as follows. Consider the product 

6{x)d{x~ i ) = 1 + x dl " d2 + x dl ~ d3 + • • • + x dl - d » a+i 

+ x **-*i + i + x d *-** + • • • + a^-V+i 



Since the di are elements of a perfect difference set, each integer 1, 2, 
• • • , n — 1 appears as an exponent in this polynomial exactly once. 
Thus, in the algebra of polynomials modulo x" — 1, 

6(x)d(x- 1 ) = v a + 1+ x + x 2 + • • • x n ~\ (2) 

The reciprocal polynomial of 6 (x), which is denoted by 6 (x), is 
equal to x (deBree of fl(x)) • dix" 1 ). Since p' = mod p r , (2) reduces to 

(x - l)6(x)d*(x) = 

= q(x)(x n -l) (3) 

for some polynomial q(x)j Let 6 (x) = f(x)h(x) where h(x) is the 

tlf the code symbols are chosen from GF((p'Y), p' a prime not equal to p, 
then GCD(d(x),x n — 1) equals a nonzero ground-field element, and the code speci- 
fied by h(x) is the trivial code which has n parity checks and no information sym- 
bols. 
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greatest common divisor of 6(x) and x n — 1. That is, 

h(x) = GCD(d(x),x n - 1). (4) 

As a result the ideals (cyclic codes) in the algebra of polynomials modulo 
x n — 1 generated by 6(x) and h(x) are identical. Thus, the rank of the 
matrix is simply n minus the degree of h(x), i.e., the number of check 
digits in the code generated by g(x) = (x n — l)/h(x). 

In an accompanying paper, Graham and MacWilliams prove that 
there are exactly 
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" " A ' = IA 2 )} + ' (5) 

check symbols in a difference-set cyclic (n,k) code over GF (p). But since 
d(x) and x n — 1 are both polynomials over GF(p), so are h(x) and 
g(x), regardless of the field from which the code symbols are chosen. 
Thus, (5) holds over GF(p r ), r ^ s, as well. 

Although the derivation of (5) is fairly involved, it is easy to see that 
n — k 2& (n + l)/2. For each zero of x n — 1 except unity must be a 
zero of either 0(x), 0*(x) or both, so it must also be a zero of either 
h{x), /&*0c)orboth. That is, 

(x - l)h(x)l*(x) = r(x)(x n - 1) 

where r (x)f (x)f* (x) = q(x). Therefore, the degree of h(x) that is, k, 
cannot be less than (n — l)/2 and n — k ^ (n + l)/2. 

As defined, g(x) is the generator polynomial of the code whose null 
space is generated by h(x). Two polynomials multiply to zero in the 
algebra of polynomials modulo x" — 1 only if the dot product of their 
coefficient vectors, with the order of the components reversed in one 
of them, is zero. Thus, the coefficient vectors of 6* (x), xd*(x), ■ ■ • , 
x"~ l 6*(x) are in the null space of the code generated by g(x). Each of 
these vectors represents a generalized parity check equation on certain 
symbols in each code word. Since each of these equations has p" + 1 
nonzero terms, each of the n symbols in every code vector is involved 
in exactly p" + 1 equations. This follows from the fact that all the rows 
of the matrix 6 are cyclically shifted versions of the first row and thus 
all columns and rows have the same weight. Furthermore, because a 
perfect difference set generates each difference exactly once, no two of 
the p* 4- 1 equations which check a particular symbol can both check 
any other symbol. For if they could, this would imply that some differ- 
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ence was generated twice by the perfect difference set, which is impossi- 
ble. 

Consequently, these equations form an "orthogonal check set" of 
order p" + 1 on the symbol in question. Massey 9 has denned such a set 
to consist of a collection of equations, all of which check a particular 
symbol, with the property that no two symbols appear together in 
more than one equation. He has shown that if it is possible to form an 
orthogonal check set of order d — 1 on any symbol in a cyclic code, 
then the code has minimum distance at least d and can be decoded with 
majority-logic decoding. Thus, difference-set codes have minimum dis- 
tance at least p* -f- 2 and, as described in Section III, can be decoded 
in a very straightforward manner. 

Although codes exist over all finite fields, binary codes are, from a 
practical viewpoint, the most interesting. Table I contains a list of the 
first few binary difference-set codes and their generator polynomials. 
These codes have several interesting properties. For example, let d 
denote the minimum distance of a code which can be realized by thresh- 
old decoding and let d denote the minimum distance of its dual code. 

Table I — List of Binary Difference-Set Cyclic Codes 
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« = 2" 

+ 2' + 

1 


* 


d = 2« 

+ 2 


/ = 2""' 


Generator polynominal, 
«(*) 


Difference — set polynomial 


1 


7 


3 


4 


1 


4,3,2,0 


3,2,0 


•>, 


21 


11 


6 


2 


10,7,6,4,2,0 


11,8,7,2,0 


3 


73 


45 


10 


4 


28,25,22,10,12,8,6,4,2,0 


45,42,36,29,25,24,10,2, 


201,196,186,167,166, 


4 


273 


191 


18 


8 


82,77,76,71,67,66,56,52,48, 












40,36,34,24,22,18,10,4,0 


159,128,126,115,112, 
103,67,50,46,24,18,0 


5 


1057 


813 


34 


16 


244,242,236,234,232,228, 
226,224,222,216,214,212, 
211,210,209,208,203,202, 
201,200,199,198,195,194, 
193,191,189,188,186,184, 
183,182,181,180,179,178, 
177,176,175,174,169,167, 
166,165,164,161,160,158, 
155,154,153,151,150,149, 
147,146,142,141,138,137, 
135,132,131,129,126,124, 
123,122,121,120,116,115, 
114,111,108,106,105,103, 
101,98,96,95,88,83,81, 
79,76,75,74,72,71,70,68, 
62,59,55,52,51,48,47,45, 
43,41,39,37,35,33,32,28, 
27,26,23,22,18,17,14,11, 
5,4,3,1,0 


1023,990,924,905,879, 
792,754,702,697,677, 
597,555,528,511,452, 
439,348,338,298,277, 
255,219,138,127,109, 
63,54,31,15,7,3,1,0 
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Since any symbol appears in all equations orthogonal on that symbol 
and no other symbol appears in more than one of these equations, it is 
clear that the following bound holds for all block codes decoded with 
threshold decoding: 

(d' - l)(d - 1) ^ n - 1. (6) 

For difference-set codes d = 2" -f- 2, and in the binary case at least, 
d = 2* -f- 1, the weight of 6(x). Thus, the equality holds in (6) and the 
codes are, in this peculiar sense, optimal. 

In summation, it has been shown that there exists a class of cyclic 
codes of length n = p 2 " + p" + 1, i.e., those generated by g(x) = (x n — 1) 
/h(x) where h(x) = GCD(0(x), x n - 1), which have 
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parity symbols 8 and which have the polynomials d(x) and its multiples 
in their null spaces. Because of this latter property, the codes have mini- 
mum distance of at least p* + 2. Also, in what follows, it is shown that 
this property can be used to implement these codes as random-error 
correctors in a remarkably simple manner. 

III. IMPLEMENTATION 

Because the codes are cyclic they can be encoded simply. See pages 
148 and 149 in Peterson. 10 

Massey's majority -logic implementation of Meggitt's 11 general decoder 
for cyclic codes can be used to decode difference-set cyclic codes. A 
decoder of this type is shown in Fig. 1 ; it operates as follows. With the 
switch in the D position, the fc-symbol data sequence is shifted into the 
syndrome and data registers simultaneously. When the entire data 
block has been entered, the switch is thrown to position P and the n-k 
received parity checks are shifted into the syndrome register, forming 
the syndrome. At this time, the output of the majority gate equals the 
additive inverse of the noise digit which was added to the first data 
symbol by the channel, provided that fewer than p" -1 errors occurred 
in the word.f Consequently, all that must be done to correct the first 
symbol is to add the output of the majority gate to the received sym- 
bol. This is done by the adder (© ) during the first shift of the registers. 

tThe majority gate has the following characteristics: Its output equals the 
additive inverse of the ground-field element which occurs most frequently among 
its p' + 1 inputs, provided that that element occurs at least p'' 1 + 1 times. Other- 
wise it equals zero. 
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Fig. 1 — Fixed threshold majority-logic decoder for difference-set cyclic codes. 



Because of the cyclic nature of the codes, repeating this process fc times 
corrects all errors in the data section of the word. 

Performance can be improved slightly at virtually no cost by the 
addition of the dotted connection and its associated adder to the de- 
coder. This circuit removes the effects of corrected errors from the 
syndrome as the errors are corrected. This can be seen as follows. The 
first (highest-order) data symbol is checked by the parity check sym- 
bols stored in the shift register stages just to the left of the feedback 
connections. (This can be seen by examining the generator matrix of 
the code in systematic form.) If a particular ground-field element is 
added to the first information symbol to correct it, in order to remove 
the error from the parity check equations which checked that symbol, 
it is necessary to add the same ground-field element to each of these 
parity check symbols. This can be accomplished by adding the symbol 
to the feedback signal and shifting the register once. Successive correc- 
tions can be made in exactly the same manner. 

Although a code will correct all error patterns of weight not greater 
than p 8_1 and some of greater weight if this connection is omitted, many 
more patterns of weight greater than p'" 1 will be corrected if it is in- 
cluded. 

The presence of this connection also enables the decoder to delect 
undecodable error patterns. This is done by shifting the syndrome 
register n — k times after the data symbols are corrected. A decodable 
pattern will have an all-zero syndrome after correction, while an un- 
decodable pattern will not. 
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The connections from the syndrome register to the p 8 + 1 summing 
circuits are made as follows. Each of the p" + 1 equations orthogonal 
on the first information symbol involves one or more parity check sym- 
bols. The sum modulo p r of all check symbols involved in the ith equa- 
tion, i = 1, 2, • • • , p" + 1, equals the ith check sum orthogonal on the 
first information symbol. Thus, the inputs to the ith summing circuit 
are simply those parity check symbols involved in the ith equation. 

This point is illustrated in Fig. 2 in which the decoder for the (73,45) 
binary code listed in Table I is depicted. Table II lists the 28-bit parity 
check sections of the nine composite parity check equations orthogonal 
on the first information symbol. Each of these equations manifests 
itself as one of the nine inputs to the majority gate of Fig. 2.f 

A modification of threshold decoding, Variable Threshold Decoding, 
has been used to decode quasi-cyclic codes. 12 It can also be used here to 
improve performance somewhat, at the cost of a slight increase in 
complexity. Instead of keeping the threshold set at p"~ l + 1, it is ini- 
tially set at its maximum value, p" + 1 , and an attempt is made to de- 
code each of the n symbols of the received word. When an w-symbol 
cyclic revolution of the syndrome has been completed without any 
changes being made, the threshold is reduced by one and another attempt 
is made. If another complete revolution is made with do changes, the 
threshold is lowered again. If a change is made, however, the threshold 
is immediately raised by one and decoding continues. Upon the com- 
pletion of the revolution, the threshold is again lowered by oue. 

Eventually one of two things must occur. Either the threshold will 
drop to its minimum value and remain there, or it will enter into some 
sort of limit cycle wherein it changes repetitively between two or more 
levels. In a practical system this latter difficulty can be obviated by ter- 
minating decoding after a fixed number of attempts, and if it is ap- 
propriate, signaling a detected error if the syndrome is not all zeros. 
It seems likely that roughly 2d cyclic revolutions of the word will suffice 
to decode nearly all decodable error patterns. 

IV. A COMPARISON 

In an unpublished report, 13 the author estimated that approximately 
3600 transistors would be required to instrument a decoder for the 
(273,200), d = 18, code formed by shortening the (511,438) primitive 
BCH code. J Also it was estimated that the decoder's internal circuitry 

t Using a combination of sequential and combinational circuits, rather than 
strictly combinational circuits, would undoubtedly result in a slightly cheaper, but 
conceptually more complex decoder. 

$ This was before Berlekamp's work. 6, 10 
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Table II — Parity Sections of the Nine Composite Parity 

Check Equations Orthogonal on First Information 

Symbol in (73, 45) Code. 
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would have to operate roughly 85 times faster than line speed to enable 
it to keep up with the data. These estimates were based on the assump- 
tions that only transistor storage was used and that speed would be 
sacrificed to reduce the number of transistors needed whenever practical. 
For example, the decoder is a serial, rather than parallel, device. 

Assuming that the syndrome register, exclusive-OR circuits and ma- 
jority gate are duplicated, the internal circuitry of the decoder for the 
(273,191), d = 18, binary difference set code can operate at line speed. 
The numbers of transistors required for the various decoder components 
are tabulated below. 



Circuit Function 


Number of Transistors 


Data register 


382 


Syndrome registers (2) 


328 


Exclusive-OR's 


400 


Majority gates (2) 


40 


Clock and switches 


30 


Miscellaneous 


20 



Total 



1200 



The complexity of the two decoders is compared in the following 
table. 



Decoder for 

BCH Code 
Difference-Set Code 



Code Efficiency 

0.73 
0.70 



Decoder 
Clock Rate 
Number of (multiples of 
Transistors fine bit rate) 



3600 
1200 



85 
1 



Ease of Design, 

Construction, 

& Testing 

difficult 
very simple 
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This type of comparison is quite crude and is admittedly chosen to 
illustrate the strong points of difference-set codes. Also, in light of 
Berlekamp's work, 5 - 16 it may be possible to reduce the number of tran- 
sistors required for the BCH decoder by as much as a factor of two and 
its speed by twice that. However, despite these facts, the difference-set 
decoder remains a much simpler piece of equipment than the BCH 
decoder. Also, a comparison of longer, more powerful codes would 
demonstrate the relative simplicity of the difference-set decoder even 
more dramatically. 

This comparison is not intended to demean the BCH codes or their 
very elegant and general decoding algorithm. There are certainly many 
cases, in fact nearly all cases involving long, relatively efficient random- 
error-correcting codes, in which they are by far the most easily imple- 
mented codes. Rather, the comparison is simply intended to point out 
that, in certain cases, difference-set codes are much easier to implement 
that the BCH codes, and to suggest that there may be other classes of 
cyclic codes for which the same is true. 

V. CONCLUSIONS 

A new, relatively small, class of random-error-correcting cyclic codes 
has been presented. These codes, which are approximately as powerful 
as the best cyclic codes for given values of efficiency and length, are 
very easily implemented. Consequently, they are concluded to be at- 
tractive for use in error-control systems where forward-acting random- 
error-correction is required. 

VI. ADDENDA 

Subsequent to the discovery of these codes, the author became aware 
of the unpublished, but earlier, work of L. D. Rudolph. 14 In it a class of 
threshold-decodable codes, which contains the class of difference-set 
cyclic codes, is described. Also, (6) has been derived by Mitchell in 
Ref. 15. 
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